Atmail WebMail 7.0.2 Cross Site Scripting

`=============================================  
INTERNET SECURITY AUDITORS ALERT 2013-004  
- Original release date: March 9th, 2013  
- Last revised: March 25th, 2013  
- Discovered by: Vicente Aguilera Diaz  
- Severity: 4.3/10 (CVSSv2 Base Scored)  
- CVE-ID: CVE-2013-2585  
=============================================  
  
I. VULNERABILITY  
-------------------------  
Reflected XSS in the view attachment message process of the Atmail  
WebMail <= v7.0.2  
  
II. BACKGROUND  
-------------------------  
Atmail allows users to access IMAP Mailboxes of any server of your  
choice. The software provides a comprehensive email-suite for  
accessing user mailboxes, and provides an inbuilt Calendar and  
Addressbook features. The WebMail Client of Atmail supports any  
existing IMAP server running under Unix/Linux or Windows systems.  
  
III. DESCRIPTION  
-------------------------  
Has been detected a reflected XSS vulnerability in the view attachment  
message process of the Atmail WebMail, that allows the execution of  
arbitrary HTML/script code to be executed in the context of the victim  
user's browser.  
  
The code injection is done through the file name parameter, and  
requires that the user victim is authenticated in the WebMail.  
  
IV. PROOF OF CONCEPT  
-------------------------  
When a user opens a file attachment in an email, the link is as follows:  
  
http://<atmail-server>/index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId/<ID>/filenameOriginal/<file>  
  
where:  
- <atmail-server> is the Atmail WebMail server  
- <ID> is the unique ID for the message that contains the attachment  
- <file> is the attachment file in the message  
  
A malicious user can inject arbitrary HTML/script code in the <file>  
parameter. For example:  
  
http://<atmail-server>/index.php/mail/viewmessage/getattachment/folder/INBOX/uniqueId/<ID>/filenameOriginal/test.txt<H1><marquee>This+is+an+XSS+example  
  
V. BUSINESS IMPACT  
-------------------------  
An attacker can execute arbitrary HTML or script code in a targeted  
user's browser, this can leverage to steal sensitive information as  
user credentials, personal data, etc.  
  
VI. SYSTEMS AFFECTED  
-------------------------  
Tested in Atmail 7.0.2. Other versions may be affected too.  
  
VII. SOLUTION  
-------------------------  
Update to version 7.0.3.  
  
VIII. REFERENCES  
-------------------------  
http://www.atmail.com  
http://www.isecauditors.com  
  
IX. CREDITS  
-------------------------  
This vulnerability has been discovered  
by Vicente Aguilera Diaz (vaguilera (at) isecauditors (dot) com).  
  
X. REVISION HISTORY  
-------------------------  
March 9, 2013: Initial release  
  
XI. DISCLOSURE TIMELINE  
-------------------------  
March 9, 2013: Vulnerability acquired by  
Internet Security Auditors (www.isecauditors.com)  
March 10, 2013: Contacts to Atmail without response.  
March 19, 2013: Second attempt: Twitting. Third: Facebooking.  
Let's get Social!  
March 21, 2013: Response and sent to Security Team.  
March 25, 2013: Version 7.0.3 published.  
March 27, 2013: Advisory sent to lists.  
  
XII. LEGAL NOTICES  
-------------------------  
The information contained within this advisory is supplied "as-is"  
with no warranties or guarantees of fitness of use or otherwise.  
Internet Security Auditors accepts no responsibility for any damage  
caused by the use or misuse of this information.  
  
XIII. ABOUT  
-------------------------  
Internet Security Auditors is a Spain based leader in web application  
testing, network security, penetration testing, security compliance  
implementation and assessing. Our clients include some of the largest  
companies in areas such as finance, telecommunications, insurance,  
ITC, etc. We are vendor independent provider with a deep expertise  
since 2001. Our efforts in R&D include vulnerability research, open  
security project collaboration and white-papers, presentations and  
security events participation and promotion. For further information  
regarding our security services, contact us.  
  
XIV. FOLLOW US  
-------------------------  
You can follow Internet Security Auditors, news and security  
advisories at:  
https://www.facebook.com/ISecAuditors  
https://twitter.com/ISecAuditors  
http://www.linkedin.com/company/internet-security-auditors  
http://www.youtube.com/  
`